diff --git a/dlls/oleaut32/tests/usrmarshal.c b/dlls/oleaut32/tests/usrmarshal.c
index 38827b1..ce1a88f 100644
--- a/dlls/oleaut32/tests/usrmarshal.c
+++ b/dlls/oleaut32/tests/usrmarshal.c
@@ -572,6 +572,7 @@ static void test_marshal_VARIANT(void)
     LPSAFEARRAY lpsa;
     DECIMAL dec, dec2;
     HeapUnknown *heap_unknown;
+    int win95_correction = 4;
 
     stubMsg.RpcMsg = &rpcMsg;
 
@@ -600,11 +601,11 @@ static void test_marshal_VARIANT(void)
     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
     ok(stubMsg.BufferLength == 21, "size %d\n", stubMsg.BufferLength);
 
-    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = HeapAlloc(GetProcessHeap(), 0, stubMsg.BufferLength);
-    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
+    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = HeapAlloc(GetProcessHeap(), 0, stubMsg.BufferLength + win95_correction);
+    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength + win95_correction;
     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
-    ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
-    wirev = (DWORD*)buffer;
+    ok(next == buffer + stubMsg.BufferLength + win95_correction, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
+    wirev = (DWORD*)(buffer + win95_correction);
     
     check_variant_header(wirev, &v, stubMsg.BufferLength);
     wirev += 5;
@@ -614,7 +615,7 @@ static void test_marshal_VARIANT(void)
         VariantInit(&v2);
         stubMsg.Buffer = buffer;
         next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
-        ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
+        ok(next == buffer + stubMsg.BufferLength + win95_correction, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
         ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
         ok(V_I1(&v) == V_I1(&v2), "got i1 %x expect %x\n", V_I1(&v), V_I1(&v2));
 
@@ -630,11 +631,11 @@ static void test_marshal_VARIANT(void)
     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
     ok(stubMsg.BufferLength == 22, "size %d\n", stubMsg.BufferLength);
 
-    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = HeapAlloc(GetProcessHeap(), 0, stubMsg.BufferLength);
-    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
+    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = HeapAlloc(GetProcessHeap(), 0, stubMsg.BufferLength + win95_correction);
+    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength + win95_correction;
     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
-    ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
-    wirev = (DWORD*)buffer;
+    ok(next == buffer + stubMsg.BufferLength + win95_correction, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
+    wirev = (DWORD*)(buffer + win95_correction);
 
     check_variant_header(wirev, &v, stubMsg.BufferLength);
     wirev += 5;
@@ -644,7 +645,7 @@ static void test_marshal_VARIANT(void)
         VariantInit(&v2);
         stubMsg.Buffer = buffer;
         next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
-        ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
+        ok(next == buffer + stubMsg.BufferLength + win95_correction, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
         ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
         ok(V_I2(&v) == V_I2(&v2), "got i2 %x expect %x\n", V_I2(&v), V_I2(&v2));
 
@@ -661,8 +662,8 @@ static void test_marshal_VARIANT(void)
     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
     ok(stubMsg.BufferLength == 26, "size %d\n", stubMsg.BufferLength);
 
-    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = HeapAlloc(GetProcessHeap(), 0, stubMsg.BufferLength);
-    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
+    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = HeapAlloc(GetProcessHeap(), 0, stubMsg.BufferLength + win95_correction);
+    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength + win95_correction;
     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
     wirev = (DWORD*)buffer;
@@ -697,11 +698,11 @@ static void test_marshal_VARIANT(void)
     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
     ok(stubMsg.BufferLength == 24, "size %d\n", stubMsg.BufferLength);
 
-    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = HeapAlloc(GetProcessHeap(), 0, stubMsg.BufferLength);
-    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
+    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = HeapAlloc(GetProcessHeap(), 0, stubMsg.BufferLength + win95_correction);
+    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength + win95_correction;
     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
-    ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
-    wirev = (DWORD*)buffer;
+    ok(next == buffer + stubMsg.BufferLength + win95_correction, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
+    wirev = (DWORD*)(buffer + win95_correction);
     
     check_variant_header(wirev, &v, stubMsg.BufferLength);
     wirev += 5;
@@ -712,7 +713,7 @@ static void test_marshal_VARIANT(void)
         VariantInit(&v2);
         stubMsg.Buffer = buffer;
         next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
-        ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
+        ok(next == buffer + stubMsg.BufferLength + win95_correction, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
         ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
         ok(V_I4(&v) == V_I4(&v2), "got i4 %x expect %x\n", V_I4(&v), V_I4(&v2));
 
@@ -729,11 +730,11 @@ static void test_marshal_VARIANT(void)
     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
     ok(stubMsg.BufferLength == 24, "size %d\n", stubMsg.BufferLength);
 
-    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = HeapAlloc(GetProcessHeap(), 0, stubMsg.BufferLength);
-    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
+    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = HeapAlloc(GetProcessHeap(), 0, stubMsg.BufferLength + win95_correction);
+    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength + win95_correction;
     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
-    ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
-    wirev = (DWORD*)buffer;
+    ok(next == buffer + stubMsg.BufferLength + win95_correction, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
+    wirev = (DWORD*)(buffer + win95_correction);
     
     check_variant_header(wirev, &v, stubMsg.BufferLength);
     wirev += 5;
@@ -743,7 +744,7 @@ static void test_marshal_VARIANT(void)
         VariantInit(&v2);
         stubMsg.Buffer = buffer;
         next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
-        ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
+        ok(next == buffer + stubMsg.BufferLength + win95_correction, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
         ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
         ok(V_UI4(&v) == V_UI4(&v2), "got ui4 %x expect %x\n", V_UI4(&v), V_UI4(&v2));
 
@@ -761,8 +762,8 @@ static void test_marshal_VARIANT(void)
     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
     ok(stubMsg.BufferLength == 28, "size %d\n", stubMsg.BufferLength);
 
-    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = HeapAlloc(GetProcessHeap(), 0, stubMsg.BufferLength);
-    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
+    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = HeapAlloc(GetProcessHeap(), 0, stubMsg.BufferLength + win95_correction);
+    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength + win95_correction;
     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
     wirev = (DWORD*)buffer;
@@ -794,11 +795,11 @@ static void test_marshal_VARIANT(void)
     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
     ok(stubMsg.BufferLength == 24, "size %d\n", stubMsg.BufferLength);
 
-    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = HeapAlloc(GetProcessHeap(), 0, stubMsg.BufferLength);
-    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
+    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = HeapAlloc(GetProcessHeap(), 0, stubMsg.BufferLength + win95_correction);
+    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength + win95_correction;
     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
-    ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
-    wirev = (DWORD*)buffer;
+    ok(next == buffer + stubMsg.BufferLength + win95_correction, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
+    wirev = (DWORD*)(buffer + win95_correction);
      
     check_variant_header(wirev, &v, stubMsg.BufferLength);
     wirev += 5;
@@ -808,7 +809,7 @@ static void test_marshal_VARIANT(void)
         VariantInit(&v2);
         stubMsg.Buffer = buffer;
         next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
-        ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
+        ok(next == buffer + stubMsg.BufferLength + win95_correction, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
         ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
         ok(V_R4(&v) == V_R4(&v2), "got r4 %f expect %f\n", V_R4(&v), V_R4(&v2));
 
@@ -890,11 +891,11 @@ static void test_marshal_VARIANT(void)
     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
     ok(stubMsg.BufferLength == 22, "size %d\n", stubMsg.BufferLength);
 
-    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = HeapAlloc(GetProcessHeap(), 0, stubMsg.BufferLength);
-    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
+    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = HeapAlloc(GetProcessHeap(), 0, stubMsg.BufferLength + win95_correction);
+    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength + win95_correction;
     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
-    ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
-    wirev = (DWORD*)buffer;
+    ok(next == buffer + stubMsg.BufferLength + win95_correction, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
+    wirev = (DWORD*)(buffer + win95_correction);
     
     check_variant_header(wirev, &v, stubMsg.BufferLength);
     wirev += 5;
@@ -904,7 +905,7 @@ static void test_marshal_VARIANT(void)
         VariantInit(&v2);
         stubMsg.Buffer = buffer;
         next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
-        ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
+        ok(next == buffer + stubMsg.BufferLength + win95_correction, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
         ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
         ok(V_BOOL(&v) == V_BOOL(&v2), "got bool %x expect %x\n", V_BOOL(&v), V_BOOL(&v2));
 
@@ -996,11 +997,11 @@ static void test_marshal_VARIANT(void)
     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
     ok(stubMsg.BufferLength == 20, "size %d\n", stubMsg.BufferLength);
 
-    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = HeapAlloc(GetProcessHeap(), 0, stubMsg.BufferLength);
-    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
+    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = HeapAlloc(GetProcessHeap(), 0, stubMsg.BufferLength + win95_correction);
+    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength + win95_correction;
     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
-    ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
-    wirev = (DWORD*)buffer;
+    ok(next == buffer + stubMsg.BufferLength + win95_correction, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
+    wirev = (DWORD*)(buffer + win95_correction);
 
     check_variant_header(wirev, &v, stubMsg.BufferLength);
     if (VARIANT_UNMARSHAL_WORKS)
@@ -1008,7 +1009,7 @@ static void test_marshal_VARIANT(void)
         VariantInit(&v2);
         stubMsg.Buffer = buffer;
         next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
-        ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
+        ok(next == buffer + stubMsg.BufferLength + win95_correction, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
         ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
 
         VARIANT_UserFree(&umcb.Flags, &v2);
@@ -1022,11 +1023,11 @@ static void test_marshal_VARIANT(void)
     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
     ok(stubMsg.BufferLength == 20, "size %d\n", stubMsg.BufferLength);
 
-    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = HeapAlloc(GetProcessHeap(), 0, stubMsg.BufferLength);
-    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
+    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = HeapAlloc(GetProcessHeap(), 0, stubMsg.BufferLength + win95_correction);
+    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength + win95_correction;
     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
-    ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
-    wirev = (DWORD*)buffer;
+    ok(next == buffer + stubMsg.BufferLength + win95_correction, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
+    wirev = (DWORD*)(buffer + win95_correction);
 
     check_variant_header(wirev, &v, stubMsg.BufferLength);
     if (VARIANT_UNMARSHAL_WORKS)
@@ -1034,7 +1035,7 @@ static void test_marshal_VARIANT(void)
         VariantInit(&v2);
         stubMsg.Buffer = buffer;
         next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
-        ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
+        ok(next == buffer + stubMsg.BufferLength + win95_correction, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
         ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
 
         VARIANT_UserFree(&umcb.Flags, &v2);
@@ -1123,11 +1124,11 @@ static void test_marshal_VARIANT(void)
 
     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
     ok(stubMsg.BufferLength == 152, "size %d\n", stubMsg.BufferLength);
-    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = HeapAlloc(GetProcessHeap(), 0, stubMsg.BufferLength);
-    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
+    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = HeapAlloc(GetProcessHeap(), 0, stubMsg.BufferLength + win95_correction);
+    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength + win95_correction;
     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
-    ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
-    wirev = (DWORD*)buffer;
+    ok(next == buffer + stubMsg.BufferLength + win95_correction, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
+    wirev = (DWORD*)(buffer + win95_correction);
     
     check_variant_header(wirev, &v, stubMsg.BufferLength);
     wirev += 5;
@@ -1141,7 +1142,7 @@ static void test_marshal_VARIANT(void)
         VariantInit(&v2);
         stubMsg.Buffer = buffer;
         next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
-        ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
+        ok(next == buffer + stubMsg.BufferLength + win95_correction, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
         ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
         ok(SafeArrayGetDim(V_ARRAY(&v)) == SafeArrayGetDim(V_ARRAY(&v)), "array dims differ\n");  
         SafeArrayGetLBound(V_ARRAY(&v), 1, &bound);
@@ -1164,11 +1165,11 @@ static void test_marshal_VARIANT(void)
 
     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
     ok(stubMsg.BufferLength == 152, "size %d\n", stubMsg.BufferLength);
-    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = HeapAlloc(GetProcessHeap(), 0, stubMsg.BufferLength);
-    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
+    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = HeapAlloc(GetProcessHeap(), 0, stubMsg.BufferLength + win95_correction);
+    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength + win95_correction;
     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
-    ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
-    wirev = (DWORD*)buffer;
+    ok(next == buffer + stubMsg.BufferLength + win95_correction, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
+    wirev = (DWORD*)(buffer + win95_correction);
     
     check_variant_header(wirev, &v, stubMsg.BufferLength);
     wirev += 5;
@@ -1184,7 +1185,7 @@ static void test_marshal_VARIANT(void)
         VariantInit(&v2);
         stubMsg.Buffer = buffer;
         next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
-        ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
+        ok(next == buffer + stubMsg.BufferLength + win95_correction, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
         ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
         ok(SafeArrayGetDim(*V_ARRAYREF(&v)) == SafeArrayGetDim(*V_ARRAYREF(&v)), "array dims differ\n");  
         SafeArrayGetLBound(*V_ARRAYREF(&v), 1, &bound);
@@ -1257,11 +1258,11 @@ static void test_marshal_VARIANT(void)
 
     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
     ok(stubMsg.BufferLength > 32, "size %d\n", stubMsg.BufferLength);
-    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = HeapAlloc(GetProcessHeap(), 0, stubMsg.BufferLength);
-    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
+    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = HeapAlloc(GetProcessHeap(), 0, stubMsg.BufferLength + win95_correction);
+    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength + win95_correction;
     memset(buffer, 0xcc, stubMsg.BufferLength);
     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
-    wirev = (DWORD*)buffer;
+    wirev = (DWORD*)(buffer + win95_correction);
     check_variant_header(wirev, &v, next - buffer);
     wirev += 5;
 
@@ -1270,10 +1271,10 @@ static void test_marshal_VARIANT(void)
        *wirev == (DWORD_PTR)V_UNKNOWN(&v) + 1 /* NT */, "wv[5] %08x\n", *wirev);
     wirev++;
     todo_wine
-    ok(*wirev == next - buffer - 0x20, "wv[6] %08x\n", *wirev);
+    ok(*wirev == next - buffer - win95_correction - 0x20, "wv[6] %08x\n", *wirev);
     wirev++;
     todo_wine
-    ok(*wirev == next - buffer - 0x20, "wv[7] %08x\n", *wirev);
+    ok(*wirev == next - buffer - win95_correction - 0x20, "wv[7] %08x\n", *wirev);
     wirev++;
     todo_wine
     ok(*wirev == 0x574f454d, "wv[8] %08x\n", *wirev);